CVE-2021-4445

MEDIUM EXPLOITED

Premium Addons for Elementor < 4.5.1 - Authenticated Arbitrary Option Update via pa_dismiss_admin_notice AJAX Action

Title source: llm

Exploitation Summary

CVE-2021-4445 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.

References (5)

Core 5

Core References

Mailing List, Third Party Advisory

https://ithemes.com/blog/wordpress-vulnerability-report-september-2021-part-2/#ib-toc-anchor-2

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2590819%40premium-addons-for-elementor&new=2590819%40premium-addons-for-elementor&sfp_email=&sfph_mail=

Product

https://wordpress.org/plugins/premium-addons-for-elementor/

Exploit, Third Party Advisory

https://wpscan.com/vulnerability/2e5b3608-1dfc-468f-b3ae-12ce7c25ee6c

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb36-d2abcd67861e?source=cve

Scores

CVSS v3 6.5

EPSS 0.0039

EPSS Percentile 30.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

VulnCheck KEV 2024-10-15

CWE

CWE-862

Status published

Products (2)

leap13/Premium Addons for Elementor – Powerful Elementor Templates & Widgets < 4.5.1

leap13/premium_addons_for_elementor < 4.5.2

Published Oct 16, 2024

Tracked Since Feb 18, 2026